MAL-2026-12317
Dashboard / Malicious Package / MAL-2026-12317
MAL-2026-12317
Summary: Malicious code in @cryptosrvc/shift-sdk-v4 (npm)
Details: Source: amazon-inspector (bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a) package.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon.js collects installer host identity (hostname, username, SUDO_USER, homedir, cwd, platform/arch/release, node version), all internal and external IPv4 addresses from every network interface, the DNS domain via `dnsdomainname`, CI-provider indicators, and the full list of process.env variable names with a subset matching AWS|NPM|TOKEN|SECRET|KEY|GITHUB|SSH flagged as secret-shaped. The data is POSTed as JSON over plain HTTP to the hardcoded bare IP http://138.68.108.20:80/cb with a 4-second timeout and errors silently swallowed to preserve install success. A source comment frames the behavior as 'NON-SENSITIVE telemetry only', contradicting the actual enumeration of sudo user, network topology, and env-var names. The destination is an unattributed DigitalOcean IP with no relationship to any legitimate SDK publisher.
Affected packages
Package
Name: @cryptosrvc/shift-sdk-v4
Purl: pkg:npm/%40cryptosrvc/shift-sdk-v4
Affected ranges
Type: N/A
Events:
